SC-900 Practice Question: Describe the capabilities of Microsoft security solutions
Your organization needs to prevent sensitive data in SharePoint Online from being shared externally. Which Microsoft Purview solution should you use?
⚠ Common exam trap
A common mix-up: candidates confuse sensitivity labels with DLP, assuming labels alone can block sharing, but labels only apply protection (e.g., encryption) and require DLP policies to enforce sharing restrictions.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Data Loss Prevention (DLP)
Data Loss Prevention (DLP) is the correct Microsoft Purview solution because it is specifically designed to detect and prevent the unauthorized sharing of sensitive data, such as credit card numbers or personally identifiable information (PII), by applying policies that can block external sharing in SharePoint Online. DLP policies can be configured to scan content in real-time and enforce actions like blocking access or sending notifications when sensitive data is detected in external sharing scenarios.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Data Loss Prevention (DLP)
Why this is correct
Data Loss Prevention (DLP) policies are specifically designed to identify, monitor, and protect sensitive information across various locations, including SharePoint Online. By configuring DLP policies, organizations can automatically detect content containing sensitive information types, such as credit card numbers or national ID numbers, and then apply protective actions. These actions can include blocking external sharing, notifying administrators, or even encrypting the content, thereby directly preventing unauthorized data exfiltration.
- ✗
eDiscovery
Why it's wrong here
eDiscovery tools are primarily used for identifying, preserving, collecting, processing, reviewing, and producing electronically stored information (ESI) in response to legal or regulatory requests. While crucial for compliance and litigation, eDiscovery is a reactive process focused on data investigation and retrieval after an event has occurred or for ongoing legal holds. It does not offer proactive mechanisms to prevent sensitive data from being shared externally in the first place, which is the core requirement.
- ✗
Sensitivity labels
Why it's wrong here
Sensitivity labels provide a classification system for data, allowing users or automated processes to mark content with specific labels indicating its sensitivity level. While these labels can trigger protective actions like encryption or visual markings, they are fundamentally a *classification* mechanism, not an *enforcement* one on their own for preventing external sharing. To enforce restrictions based on labels, such as blocking external sharing, they typically require integration with other services like Data Loss Prevention policies or Conditional Access policies.
- ✗
Insider Risk Management
Why it's wrong here
Insider Risk Management in Microsoft Purview is designed to detect, investigate, and act on risky activities by users within an organization that could lead to data leakage or theft. It analyzes user behavior patterns, such as unusual download volumes or access to sensitive files, to identify potential insider threats. However, this solution focuses on identifying and managing *risky user behavior* rather than directly preventing specific data types from being shared externally through a policy-based content inspection mechanism, which is a proactive DLP function.
Go deeper
Related to this question
Learn chapter
Microsoft Entra ID
Key term
DLP
Data Loss Prevention — security technology that detects and prevents unauthorised transmission of sensitive data outside an organisation.
Key term
Personally identifiable information
Personally identifiable information (PII) is any data that can be used to identify, contact, or locate a specific individual, either alone or when combined with other information.
About these practice questions
One of 1,250 original SC-900 practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This SC-900 practice question is part of Courseiva's free Microsoft certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the SC-900 exam.